You have to set the qtree security to mixed or ntfs to use ACLs.
Yes, the local user approach is limited. I was just trying to clarify
the statement that "no real security is available".
Mark
-----Original Message-----
From: Alan McLachlan [mailto:amclachlan@asi.com.au]
Sent: Wednesday, April 16, 2003 4:18 PM
To: Muhlestein, Mark; Alan McLachlan; Robert Borowicz;
toasters(a)mathworks.com
Cc: Dane Knudson
Subject: RE: CIFS in Workgroup mode
Mark Muhlestein wrote:
>Alan wrote:
>> One problem is that in workgroup mode NTFS security isn't available.
>> In fact, no real security is available...
> This isn't quite right. If you are running with ONTAP 6.1.1 or later
you
> can create up to 96 local users in workgroup mode and use NTFS
security
> with NTLM authentication. Even without local users you can use
> UNIX-style security if you are willing to use /etc/passwd accounts
> (which unfortunately implies the use of plaintext passwords over the
> wire during CIFS login).
> However, it is true that for the very best available CIFS security
> (which uses Kerberos authentication) you do have to have the filer
> installed in a Win2k domain.
Hi Mark,
I just tried this on a lab filer here running 6.4.1R1 and in workgroup
mode
on an NT4.0 Workstation client (as still used by many of our government
Novell customers - some are even still using Win98...) the mapped drive
still shows up as FAT - no ACL's. I'll look into this further but I
don't
see how you're going to get ACL's on basic Windows peer-to-peer
networking.
Win2K local user account ACL's may work with WinXP workstations, but
most
customers using NetApp for home directories have hundreds or thousands
of
users. For only 96 or less users you're not going to buy a NetApp
primarily
for home dirs... (unless you have too much money to play with and
believe in
overkill, or they are VERY I/O intensive users, i.e. graphic artists,
CAD
etc :o) )
In any case, the issue here isn't whether you can use fun workarounds to
implement some security - you could use hidden shares to obscure user's
home
dirs from each other but that's not the same as real permissions. And
yes
you can map to Unix accounts on the filer and use Unix security. But the
real issue is how can this be administered from Novell eDirectory as a
resource with managed security. Local accounts (whether Unix or
post-Ontap
6.1.1 Win2K local accounts) on the filer don't help, the Novell
eDirectory
server somehow needs to be the primary account management server before
most
Novell admins will accept the solution.
Personally, I wish we didn't have to deal with Novell environments but
there
are still too many around to ignore it. *sigh*
Do you know what the status is WRT LDAP authentication in OnTap?
Regards,
Alan.
**** ASI Solutions Disclaimer ****
The material transmitted may contain confidential and/or privileged
material and is intended only for the addressee. If you receive this in
error, please notify the sender and destroy any copies of the material
immediately. ASI will protect your Privacy according to the 10 Privacy
Principles outlined under the new Privacy Act, Dec 2001.
This email is also subject to copyright. Any use of or reliance upon
this
material by persons or entities other than the addressee is prohibited.
E-mails may be interfered with, may contain computer viruses or other
defects. Under no circumstances do we accept liability for any loss or
damage which may result from your receipt of this message or any
attachments.
**** END OF MESSAGE ****